Such an operation management method exists as to notify an administrator of a message conforming to a predetermined monitoring rule in messages that are output from a monitoring target system including a plurality of systems. FIG. 1 illustrates an operation management procedure in the monitoring target system including the plurality of systems. The monitoring target system in FIG. 1 includes the plurality of systems, e.g., an information processing apparatus group 301 with their machine types and makers being different from each other. A monitoring apparatus 302 monitors the monitoring target system and collects messages issued from the information processing apparatuses within the monitoring target system. An operator apparatus 304 or another equivalent apparatus notifies the monitoring apparatus 302 of a collection target operation message beforehand, and the monitoring apparatus 302 retains this message as a monitoring rule. The monitoring apparatus 302 collects the operation messages each corresponding to the monitoring rule from the systems.
A filter processing unit of the monitoring apparatus 302 itself or a filter processing apparatus 303 operating in linkage with the monitoring apparatus 302 performs filtering the messages for reducing a load on a monitoring operator who administers the monitoring target system. The filtering is a process of, e.g., integrating, aggregating or selecting the collected messages according to the filtering rule. As a result of filtering, an operator apparatus 304 operated by the monitoring operator is notified of a smaller quantity of messages as a monitoring target event than the messages issued from the monitoring target system. The monitoring operator reports, to a person in charge, an event being determined about whether the event needs being handled in the notified monitoring target events after the filtering.
However, a large quantity of messages occur within the system including the plurality of information processing apparatuses as the case may be. There are the messages that are periodically transmitted and the message group occurring due to the same cause in the messages conforming to the predetermined monitoring rule, and a plurality of or, depending on the case, a large quantity of messages containing the same contents are output. Proposed consequently is a mechanism capable of aggregating the message group or selecting a small number of messages and outputting thus-processed message group or messages with respect to the message group generated based on the same cause and the message group containing the same content and occurring a plural number of times. The mechanism configured to aggregate the message group or to select the small number of messages involves generating, e.g., a filter rule beforehand and outputting the messages based on the filter rule.
FIG. 2 illustrates a processing instance, in which the information processing apparatus generates the filter rule, aggregates the message group containing the same content and occurring the plural number of times or selects the small number of messages, and outputs the thus-processes message group or messages. In the monitoring target system of FIG. 2, the information processing apparatus to monitor the monitoring target system accumulates the messages coming from the information processing apparatus group 301 in a message log. The information processing apparatus calculates a co-occurrence probability between messages, a, b, c and other equivalent messages accumulated in the message log. Herein, the term [co-occurrence] connotes that when a certain message occurs, another message occurs concomitantly with the occurrence of the former message. The term [co-occurrence probability] is an index indicating a probability of co-occurrence between the messages and is also said to be an index indicating a relationship between the messages. The information processing apparatus selects, as a monitoring target event, any one of the messages with the co-occurrence probability conforming to predetermined criteria between the messages, and discards other messages. This is because the messages with the co-occurrence probability conforming to the predetermined criteria can be determined to be the plurality of messages occurring due to the same cause. The mechanism described above enables restraint of an output count of messages conforming to the monitoring rule.